Module 2- Cyber Forensics

What is the primary purpose of computer forensics?

• To create software applications.

• To enhance computer performance.

• To manage network security.

• To collect and analyze digital evidence for legal purposes.

Name two open-source cyber forensics tools.

• Metasploit

• Wireshark

• Nmap

• Autopsy, Sleuth Kit

What are proprietary tools in cyber forensics?

• General software not specifically designed for forensics.

• Proprietary tools in cyber forensics are specialized software developed by companies for digital evidence analysis.

• Hardware devices used for data storage and retrieval.

• Open-source tools available for public use.

List one major challenge faced in cyber forensics.

• Insufficient funding for investigations

• Overabundance of skilled professionals

• Rapid technological evolution

• Lack of interest from law enforcement

What skills are essential for a cyber forensic expert?

• Technical knowledge, forensic tools proficiency, legal understanding, analytical skills, attention to detail, communication skills.

• Basic computer literacy

• Graphic design expertise

• Project management skills

Describe a physical requirement of a cyber forensics lab.

• A space filled with outdated technology and no monitoring systems.

• An open environment with no security measures.

• A lab located in a public area with unrestricted access.

• A secure environment with controlled access and surveillance.

What are the different types of cyber forensics?

• Computer Forensics, Network Forensics, Mobile Device Forensics, Database Forensics, Cloud Forensics, Malware Forensics, IoT Forensics

• Social Media Forensics

• Physical Security Forensics

• Email Forensics

How does digital forensics differ from traditional forensics?

• Digital forensics deals with digital evidence, while traditional forensics deals with physical evidence.

• Digital forensics only applies to cyber crimes.

• Digital forensics is less reliable than traditional forensics.

• Traditional forensics is exclusively about digital devices.

Why is documentation important in cyber forensics?

• Documentation is irrelevant in digital investigations.

• Documentation is primarily for internal team communication.

• Documentation is important in cyber forensics to ensure evidence integrity, maintain a chain of custody, and support legal proceedings.

• Documentation is only necessary for physical evidence.

What role does data recovery play in cyber forensics?

• Data recovery enables the retrieval of lost or deleted information, essential for evidence in cyber forensics.

• Data recovery is only useful for hardware failures.

• Data recovery is irrelevant in cyber forensics.

• Data recovery only applies to physical evidence.